Bennet-Brassard 1984 (BB84) protocol, we optimize the ratio of the choice of two bases, the bit basis and the phase basis by using the second order expansion for the length of the generation keys under the coherent attack. This optimization addresses the trade-off between the loss of transmitted bits due to the disagreement of their bases and the estimation error of the error rate in the phase basis. Then, we derive the optimum ratio and the optimum length of the generation keys with the second order asymptotics. Surprisingly, the second order has the order $n^{3/4}$, which is much larger than the second order $n^{1/2}$ in the conventional setting when $n$ is the number of quantum communication. This fact shows that our setting has much larger importance for the second order analysis than the conventional problem. To illustrate this importance, we numerically plot the effect of the second order correction.
We discuss long code problems in the Bennett-Brassard 1984 (BB84) quantum key distribution protocol and describe how they can be overcome by concatenation of the protocol. Observing that concatenated modified Lo-Chau protocol finally reduces to the concatenated BB84 protocol, we give the unconditional security of the concatenated BB84 protocol.
We propose a new kind of individual attack, based on randomly selected dissipation, on Bennett-Brassard 1984 protocol of practical quantum key distribution (QKD) system with lossy and noisy quantum channel. Since an adversary with super quantum channel can disguise loss and errors induced by his attack as that of the system, he can obtain innegligible amount of information for a practical QKD system, without being detected by legal participants.
This paper provides a formula for the sacrifice bit-length for privacy amplification with the Bennett-Brassard 1984 protocol for finite key lengths when we employ the decoy method. Using the formula, we can guarantee the security parameter for realizable quantum key distribution system. The key generation rates with finite key lengths are numerically evaluated. The proposed method improves the existing key generation rate even in the asymptotic setting.
The quantum key distribution protocol without public announcement of bases is equipped with a two-way classical communication symmetric entanglement purification protocol. This modified key distribution protocol is unconditionally secure and has a higher tolerable error rate of 20%, which is higher than previous scheme without public announcement of bases.
Unconditional security proofs of the Bennett-Brassard protocol of quantum key distribution have been obtained recently. These proofs cover also practical implementations that utilize weak coherent pulses in the four signal polarizations. Proven secure rates leave open the possibility that new proofs or new public discussion protocols obtain larger rates over increased distance. In this paper we investigate limits to error rate and signal losses that can be tolerated by future protocols and proofs.
We calculate eavesdropper's optimal information on raw bits in Bennett-Brassard 1984 quantum key distribution (BB84 QKD) and six-state scheme in coherent attacks, using a formula by Lo and Chau [Science 283 (1999) 2050] with single photon assumption. We find that eavesdropper's optimal information in QKD without public announcement of bases [Phys. Lett. A 244 (1998) 489] is the same as that of a corresponding QKD WITH it in the coherent attack. We observe a sum-rule concerning each party's information.
We present a tight security analysis of the Bennett-Brassard 1984 protocol taking into account the finite size effect of key distillation, and achieving unconditional security. We begin by presenting a concise analysis utilizing the normal approximation of the hypergeometric function. Then next we show that a similarly tight bound can also be obtained by a rigorous argument without relying on any approximation. In particular, for the convenience of experimentalists who wish to evaluate the security of their QKD systems, we also give explicit procedures of our key distillation, and also show ho…
A central goal in information theory and cryptography is finding simple characterizations of optimal communication rates subject to various restrictions and security requirements. Ideally, the optimal key rate for a quantum key distribution (QKD) protocol would be given by {\em single-letter formula} involving a simple optimization over a single use of an effective channel. We explore the possibility of such a formula for one of the simplest and most widely used QKD protocols--Bennett-Brassard-84 (BB84) with one way classical post-processing. We show that a conjectured single-letter key-rate f…
Most experimental realizations of quantum key distribution are based on the Bennett-Brassard 1984 (so-called BB84) protocol. In a typical optical implementation of this scheme, the sender uses an active source to produce the required BB84 signal states. While active state preparation of BB84 signals is a simple and elegant solution in principle, in practice passive state preparation might be desirable in some scenarios, for instance, in those experimental setups operating at high transmission rates. Passive schemes might also be more robust against side-channel attacks than active sources. Typ…
In practical quantum cryptography, the source sometimes produces multi-photon pulses, thus enabling the eavesdropper Eve to perform the powerful photon-number-splitting (PNS) attack. Recently, it was shown by Curty and Lutkenhaus [Phys. Rev. A 69, 042321 (2004)] that the PNS attack is not always the optimal attack when two photons are present: if errors are present in the correlations Alice-Bob and if Eve cannot modify Bob's detection efficiency, Eve gains a larger amount of information using another attack based on a 2->3 cloning machine. In this work, we extend this analysis to all distances…
It is the first scheme which allows the detection apparatus to achieve both the photon number of arriving signals and quantum bit error rate of the multiphoton pulses precisely. We show that the upper bound of the fraction of the tagged multiphoton pulses counts is $μ$, which is independent of the channel loss and the intensity of the decoy source. Such upper bound is $inherent$ and cannot be reduced any longer as long as the weak coherent scouces and high lossy channel are used. We show that our scheme can be implemented even if the channel loss is very high. A stronger intensity of the pulse…
Hong-Ou-Mandel test to verify indistinguishability of the states emitted from a quantum key distribution transmitter implementing decoy Bennett-Brassard 1984 protocol
Graduate School of Information Science and Technology, Hokkaido University（北海道大学信息科学技术研究生院）；Faculty of Information Science and Technology, Hokkaido University（北海道大学信息科学技术学部）；NEC Corporation（日本电气株式会社）；National Institute of Information and Communications Technology（国立情报学研究所）
Cryptographic scheme proposed by Bennett, Brassard, and Mermin [Phys. Rev. Lett. {\bf 68}, 557 (1992)] is reformulated in a version involving two polarizing Mach-Zehnder interferometers. Such a form, although physically equivalent to the original one, makes its security explicit, suggestive and easy to explain to non-experts.
We constructed an optical interferometer for a Bennett-Brassard quantum key distribution system using integrated optics based on planar lightwave circuit technology, and tested its operation and stability. Experimental results show that this interferometer is useful in implementing a practical quantum key distribution system.
We discuss the potential of quantum key distribution (QKD) for long distance communication by proposing a new analysis of the errors caused by dark counts. We give sufficient conditions for a considerable improvement of the key generation rates and the security thresholds of well-known QKD protocols such as Bennett-Brassard 1984, Phoenix-Barnett-Chefles 2000, and the six-state protocol. This analysis is applicable to other QKD protocols like Bennett 1992. We examine two scenarios: a sender using a perfect single-photon source and a sender using a Poissonian source.
We consider the security of the Bennett-Brassard 1984 (BB84) protocol for Quantum Key Distribution (QKD), with arbitrary individual imperfections simultaneously in the source and detectors. We provide the secure key generation rate, and show that only two parameters must be bounded to ensure security; the basis dependence of the source and a detector blinding parameter. The system may otherwise be completely uncharacterized and contain large losses.
This paper provides a security proof of the Bennett-Brassard (BB84) quantum key distribution protocol in practical implementation. To prove the security, it is not assumed that defects in the devices are absorbed into an adversary's attack. In fact, the only assumption in the proof is that the source is characterized. The proof is performed by lower-bounding adversary's Renyi entropy about the key before privacy amplification. The bound reveals the leading factors reducing the key generation rate.
We analyse the finite-size security of the efficient Bennett-Brassard 1984 protocol implemented with decoy states and apply the results to a gigahertz-clocked quantum key distribution system. Despite the enhanced security level, the obtained secure key rates are the highest reported so far at all fibre distances.
In conventional quantum key distribution protocols, the secure key is normally extracted from the measurement outcomes of the system. Here, a different approach is proposed, where the secure key is extracted from the measurement bases, rather than outcomes. Compared to the original Bennett-Brassard-1984 protocol, the proposed protocol involves no hardware change but modifications in data postprocessing. We show that this protocol is more robust against detector efficiency attacks and photon-number-splitting attacks when practical detectors and photon sources are used.
A generalization of the quantum cryptographic protocol by Bennett and Brassard is discussed, using three conjugate bases, i.e. six states. By calculating the optimal mutual information between sender and eavesdropper it is shown that this scheme is safer against eavesdropping on single qubits than the one based on two conjugate bases. We also address the question for a connection between the maximal classical correlation in a generalized Bell inequality and the intersection of mutual informations between sender/receiver and sender/eavesdropper.
We consider the security of the Bennett-Brassard 1984 (BB84) protocol for Quantum Key Distribution (QKD), in the presence of bit and basis dependent detector flaws. We suggest a powerful attack that can be used in systems with detector efficiency mismatch, even if the detector assignments are chosen randomly by Bob. A security proof is provided, valid for any basis dependent, possibly lossy, linear optical imperfections in the channel/receiver/detectors. The proof does not assume the so-called squashing detector model.
We prove the security of the Bennett-Brassard (BB84) quantum key distribution protocol for an arbitrary source whose averaged states are basis-independent, a condition that is automatically satisfied if the source is suitably designed. The proof is based on the observation that, to an adversary, the key extraction process is equivalent to a measurement in the sigma_x-basis performed on a pure sigma_z-basis eigenstate. The dependence of the achievable key length on the bit error rate is the same as that established by Shor and Preskill for a perfect source, indicating that the defects in the so…
We present security proofs for a protocol for Quantum Key Distribution (QKD) based on encoding in finite high-dimensional Hilbert spaces. This protocol is an extension of Bennett's and Brassard's basic protocol from two bases, two state encoding to a multi bases, multi state encoding. We analyze the mutual information between the legitimate parties and the eavesdropper, and the error rate, as function of the dimension of the Hilbert space, while considering optimal incoherent and coherent eavesdropping attacks. We obtain the upper limit for the legitimate party error rate to ensure uncondition…
We prove the security of the Bennett-Brassard (BB84) quantum key distribution protocol in the case where the source and detector are under the limited control of an adversary. Our proof applies when both the source and the detector have small basis-dependent flaws, as is typical in practical implementations of the protocol. We derive a general lower bound on the asymptotic key generation rate for weakly basis-dependent eavesdropping attacks, and also estimate the rate in some special cases: sources that emit weak coherent states with random phases, detectors with basis-dependent efficiency, an…
Phase randomization is a very important assumption in the Bennett-Brassard 1984 quantum key distribution (QKD) system with a weak coherent source. Thus an active phase modulator is needed to randomize the phase of source. However, it is hard to check whether the phase of source is randomized totally or not in practical QKD systems. In this paper a partially random phase attack is proposed to exploit this imperfection. Our analysis shows that Eve can break the security of a two-way QKD system by using our attack, even if an active phase randomization is adopted by Alice. Furthermore, the numeri…
Temporal steering, which is a temporal analogue of Einstein-Podolsky-Rosen steering, refers to temporal quantum correlations between the initial and final state of a quantum system. Our analysis of temporal steering inequalities in relation to the average quantum bit error rates reveals the interplay between temporal steering and quantum cloning, which guarantees the security of quantum key-distribution based on mutually-unbiased bases against individual attacks. The key distributions analyzed here include the Bennett-Brassard 1984 protocol (BB84) and the six-state 1998 protocol by Bruss (B98)…
It is demonstrated that for the entanglement-based version of the Bennett-Brassard (BB84) quantum key distribution protocol, Alice and Bob share provable entanglement if and only if the estimated qubit error rate is below 25% or above 75%. In view of the intimate relation between entanglement and security, this result sheds also new light on the unconditional security of the BB84 protocol in its original prepare-and-measure form. In particular, it indicates that for small qubit error rates 25% is the ultimate upper security bound for any prepare-and-measure BB84-type QKD protocol. On the contr…
We consider the Bennett-Brassard cryptographic scheme, which uses two conjugate quantum bases. An eavesdropper who attempts to obtain information on qubits sent in one of the bases causes a disturbance to qubits sent in the other basis. We derive an upper bound to the accessible information in one basis, for a given error rate in the conjugate basis. Independently fixing the error rate in the conjugate bases, we show that both bounds can be attained simultaneously by an optimal eavesdropping probe, consisting of two qubits. The qubits' interaction and their subsequent measurement are described…
In quantum cryptosystems, variations in detector efficiency can be exploited to stage a successful attack. This happens when the efficiencies of Bob's two detectors are different functions of a control parameter accessible to Eve (e.g., timing of the incoming pulses). It has previously been shown that the Bennett-Brassard 1984 (BB84) protocol is vulnerable to this attack. In this paper, we show that several other protocols and encodings may also be vulnerable. We consider a faked states attack in the case of a partial efficiency mismatch on the Scarani-Acin-Ribordy-Gisin 2004 (SARG04) protocol…
We consider the Unambiguous State Discrimination (USD) of two mixed quantum states. We study the rank and the spectrum of the elements of an optimal USD measurement. This naturally leads to a partial fourth reduction theorem. This theorem shows that either the failure probability equals its overall lower bound given in term of the fidelity or a two-dimensional subspace can be split off from the original Hilbert space. We then use this partial reduction theorem to derive the optimal solution for any two equally probable Geometrically Uniform (GU) states $ρ_0$ and $ρ_1=Uρ_0 U^\dagger$, $U^2={\op…
One of the simplest methods for implementing quantum key distribution over fiber-optic communication is the Bennett-Brassard 1984 protocol with phase encoding (PE-BB84 protocol), in which the sender uses phase modulation over double pulses from a laser and the receiver uses a passive delayed interferometer. Using essentially the same setup and by regarding a train of many pulses as a single block, one can carry out the so-called differential quadrature phase shift (DQPS) protocol, which is a variant of differential phase shift (DPS) protocols. Here we prove the security of the DQPS protocol ba…
The first quantum cryptography protocol, proposed by Bennett and Brassard in 1984 (BB84), has been widely studied in the last years. This protocol uses four states (more precisely, two complementary bases) for the encoding of the classical bit. Recently, it has been noticed that by using the same four states, but a different encoding of information, one can define a new protocol which is more robust in practical implementations, specifically when attenuated laser pulses are used instead of single-photon sources [V. Scarani et al., Phys. Rev. Lett. {\bf 92}, 057901 (2004); referred to as SARG04…
Quantum key distribution (QKD) offers the possibility for two individuals to communicate a securely encrypted message. From the time of its inception in 1984 by Bennett and Brassard, QKD has been the result of intense research. One technical challenge is the monitoring of signal disturbance in a QKD system to bound the information leakage towards an unwanted eavesdropper. Recently, the round-robin differential phase-shift (RRDPS) protocol, which encodes bits of information in a high-dimensional state space, was proposed to solve this exact problem. Since its introduction, many realizations of …
Shor and Preskill have provided a simple proof of security of the standard quantum key distribution scheme by Bennett and Brassard (BB84) by demonstrating a connection between key distribution and entanglement purification protocols with one-way communications. Here we provide proofs of security of standard quantum key distribution schemes, BB84 and the six-state scheme, against the most general attack, by using the techniques of *two*-way entanglement purification. We demonstrate clearly the advantage of classical post-processing with two-way classical communications over classical post-proce…
Quantum key distribution (QKD) can be used to generate secret keys between two distant parties. Even though QKD has been proven unconditionally secure against eavesdroppers with unlimited computation power, practical implementations of QKD may contain loopholes that may lead to the generated secret keys being compromised. In this paper, we propose a phase-remapping attack targeting two practical bidirectional QKD systems (the "plug & play" system and the Sagnac system). We showed that if the users of the systems are unaware of our attack, the final key shared between them can be compromised in…
